1

My server is getting flooded by Avast Secure DNS. This was generating high I/O while writing lots of entries in daemon.log and syslog files. Thank to fail2ban, I was able to ban those IP and get the server back to normal.

I come here to ask for some details about this since I'm Linux learner. The server is running on Debian Wheezy.

Here is a sample of daemon.log file : 

Jan 27 20:47:43 server named[xxxx]: client 37.110.213.97#51810: query (cache) '2.SecureDNS.AVASt.CoM/TXT/IN' denied
Jan 27 20:47:49 server named[xxxx]: client 154.0.26.150#38513: query (cache) '2.SECUredNs.Avast.cOM/TXT/IN' denied
Jan 27 20:47:50 server named[xxxx]: client 154.0.26.150#33704: query (cache) '2.sEcurEDns.avasT.COm/TXT/IN' denied
Jan 27 20:47:54 server named[xxxx]: client 154.0.26.150#50798: query (cache) '2.sEcUreDns.avasT.com/TXT/IN' denied
Jan 27 20:48:06 server named[xxxx]: client 201.79.137.74#54727: query (cache) '2.SeCuREDnS.AvAST.CoM/TXT/IN' denied
Jan 27 20:48:07 server named[xxxx]: client 201.79.137.74#54735: query (cache) '2.secuReDNs.avaSt.cOM/TXT/IN' denied
Jan 27 20:48:11 server named[xxxx]: client 201.79.100.41#54754: query (cache) '2.SeCUrEDNS.AVAsT.COM/TXT/IN' denied
Jan 27 20:48:12 server named[xxxx]: client 77.147.247.52#62948: query (cache) '2.SecUREdns.AvAsT.COM/TXT/IN' denied
  • Is that what they call DDos attack ?
  • Why this come from Avast Secure DNS ?
  • What's the best solution to handle this ?
  • When will this stop ?
  • How can I know where this attack come from ?
JazZ
  • 121
  • 5
  • Does your server pass an open resolve test? [Example test](http://openresolver.com) – jrtapsell Jan 28 '18 at 11:03
  • @jrtapsell Hello, yes, it returned that the server is not vulnerable to DNS Amplification attacks. – JazZ Jan 28 '18 at 11:25
  • Could you use tcpdump or wireshark and record some of the incoming data? – jrtapsell Jan 28 '18 at 11:28
  • Using fail2ban with DNS, i.e. an UDP-based protocol lacking any handshake, is generally a bad idea. [Under some circumstances](https://en.wikipedia.org/wiki/IP_address_spoofing), you can easily end up with all 4 billions of IPv4 addresses banned. What purpose does your externally accessible resolver carry? – ximaera Jan 28 '18 at 20:26
  • Thanks for your reply @ximaera. That's what I'm afraid of. The server is running Plesk (websites management system). I wish I could deactivate it but not sure if the service will keep serving those websites. I asked the [question on the Plesk forum](https://talk.plesk.com/threads/server-get-flooded-ddos-using-opendns-resolver.346743/). – JazZ Jan 29 '18 at 06:24

1 Answers1

5

It's unlikely that this is coming from avast secure DNS. More likely, you're running an open DNS resolver and an attacker with a botnet is trying to DDoS Avast SecureDNS by using open resolvers to direct traffic to Avast.

David
  • 15,814
  • 3
  • 48
  • 73
  • Thank you for your reply. What can I do to stop this ? (sorry for novice question but I'm not familiar at all with this kind of stuff). I doubt the Fail2Ban solution is enough. – JazZ Jan 28 '18 at 07:49
  • Thank you leading me to right search. The Open DNS resolver is well configured to deny those queries. But the server keeps getting flooded. Since those fakes IP are maybe trusted users who wants to access the server, it's definitely not a good idea to ban them using fail2ban. I'm failing at find a good solution to stop this. – JazZ Jan 28 '18 at 08:51